![]() ![]() This is described quite well on this page of the Unity manual with this diagram: The premise of IL2CPP is to take these assemblies, parse the IL, generate C++ equivalent source code from it, then compile this C++ into machine code for faster, unmanaged execution. NET assemblies which are executed by the managed runtime (CLR) on the target platform of choice as per the norm for any. It’s a beautiful mess, and today we’re going to start picking it apart.Ī standard Unity game is distributed as a series of. IL2CPP is an alternative application deployment model introduced into Unity in 2015 which is designed to bring significant performance improvements to Unity games. ![]() how to use IL2CPP at the command-line on arbitrary code without Unity.how to setup your environment to generate C++ source code and IL2CPP binaries from your own C# code so that you can examine and compare them with your original code.what the generated C++ source code and binary disassembly of a simple function looks like compared to native C#, IL and C++ code.I'm pretty much a novice in reverse engineering so I'm sure I missed a lot of stuff, any help is welcome. *(undefined **)(ppvParm2 + 3) = &DAT_0000000f Īnd now I'm stuck, I'm looking for a way to extract this dll from the exe (if it's inside at all) and then decompile to C#.Īlternatively I would like to know if there is a way to decompile the IL code that cheat engine provides with the mono dissector tool, and translate it to readable C#. (char *)CONCAT71(in_stack_ffffffffffffffb9,in_stack_ffffffffffffffb8), Operator_delete(*ppvParm2,(MemLabelId)0x3b,bVar8,iVar9, (char *)CONCAT71(in_stack_ffffffffffffffb9,uVar10),in_stack_ffffffffffffffc0) Operator_delete((void *)CONCAT71(in_stack_ffffffffffffffb9,uVar10),(MemLabelId)0x3b,bVar8,iVar9, PpvVar5 = (void **)&stack0xffffffffffffffb8 PcVar3 = (&PTR_s_StreamingAssets/OtherAssets/Back_140f42ae8) PpuVar6 = &PTR_s_Managed/Assembly-CSharp.dll_140f42ad8 ĬVar1 = pcVar3 (I also decompiled it with 圆4dbg and got a similar result minus the variables names) undefined * FUN_1401a0070(undefined *puParm1,void **ppvParm2,undefined8 uParm3,undefined8 uParm4) I decompiled this part of the program with ghidra and got this: I debugged the game's executable with 圆4dbg, searched for string references for "Assembly-Csharp" and put a breakpoint where I think the dll is loaded, and found this: So my hypothesis is that the dll is embedded inside the exe somehow and loaded to the memory when the game starts. However, using Cheat Engine's mono dissector function I can see the two assembly dll's and all the classes and methods inside: I also used Process Monitor to check if the game loads any other. I tried decompiling the exe with dnSpy but it doesn't look like there is any. However this game doesn't have the assembly dll in the managed directory. I'm trying to reverse engineer a game made with the Unity engine, and usually all of the games's scripts are in the files \_Data\Managed\Assembly-CSharp.dll and \_Data\Managed\Assembly-CSharp-firstpass.dll. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |